CLAIMS 

1 1. A method for graphically presenting characteristics of data traffic on a distributed 

2 computer network, comprising: 

3 monitoring traffic on said network; 

4 selecting a characteristic of said traffic for display; 

5 presenting said characteristic in a graphical format, said graphical format representing 

6 said network in response to said monitoring, said network represented as nodes connected by 

7 lines, said lines representing traffic flow between nodes; and 

8 displaying a property of at least one line of said lines, said property indicating a value 

9 of said characteristic. 

1 2. The method as in claim 1, further comprising: 

2 obtaining said value from said monitoring during a selected time interval. 

1 3. The method as in claim 1, further comprising: 

2 displaying a sequence of said images, to display changes in said characteristics 

3 during a sequence of time intervals. 

1 4. The method as in claim 1, further comprising: 

2 using a width of said at least one line as said property. 
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1 5. The method as in claim 1, further comprising: 

2 using a color of said at least one line as said property. J 
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1 6. The method as in claim 1, further comprising: 

2 using an arrow drawn on said at least one line as said property. 

1 7. The method as in claim 1, further comprising: 

2 using a length of said at least one line as said property. 

1 8. The method as in claim 1, further comprising: 

2 using a density of said at least one line as said property. 

1 9. The method as in claim 1, further comprising: 

2 using a visual characteristic of said at least one line as said property. 
1 10. The method as in claim 1, further comprising: 
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2 displaying a filtering expression in a graphical user interface; 

3 selecting, from said graphical user interface, records from network information files 

4 to display said characteristic of said traffic. 



1 11. The method as in claim 10, further comprising: 

2 calculating parameters that are associated with the records selected from network files 

3 and storing the parameters in a local file. 



1 12. The method as in claim 1, further comprising: 

2 displaying the characteristic as any graphical black and white or color image capable 

3 of being displayed on a data visualization system coupled to said computer. 



1 13. The method as in claim 1, further comprising: 

2 using a filtering program to select records in network information files that meet 

3 selected filtering criteria. 



1 14. The method as in claim 13, further comprising: 

2 compiling the appropriate records from network information files during specified 

3 time intervals, each compiled record meeting at least one selected filtering criterion. 
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1 15. The method as in claim 14, further comprising: 

2 calculating data that represent the compiled records, and storing the data in a file. 



1 16. The method as in claim 1, further comprising: 

2 displaying a map of the network topology and overlaying the map with moving 

3 images that graphically portray the stored data, the moving images changing with time to 

4 reflect changes in the underlying data. 



1 17. The method of claim 1, further comprising: 

2 including a time interval criterion which indicates how often to compile and package 

3 information from the network information files. 



1 18. The method of claim 1, further comprising: 

2 displaying a network activity for a period of time within a starting time and an ending 

3 time specified within a filtering criteria. 
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1 19. A data visualization apparatus for graphically presenting characteristics of data traffic on '* 

I 

2 a distributed computer network, comprising: y I 

3 means for monitoring traffic on said network; 

4 means for selecting characteristics of said traffic for display; 

5 means for presenting said characteristics in a graphical format, said graphical format 

6 representing said network in response to said monitoring, said network represented as nodes 

7 connected by lines, said lines representing traffic flow between nodes; and 

8 means for displaying a property of at least one line of said lines, said property 

9 indicating a value of said characteristics. 



1 20. The apparatus as in claim 19, further comprising: 

2 means for obtaining said value from said monitoring during a selected time interval. 

1 21. The apparatus as in claim 19, further comprising: 

2 means for displaying a sequence of said images, to display changes in said 

3 characteristics during a sequence of time intervals. 

1 22. The apparatus as in claim 19, further comprising: 

2 means for using a width of said at least one line as said property. 
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1 23. The apparatus as in claim 19, further comprising: 

2 means for a using a color of said at least one line as said property. 

1 24. The apparatus as in claim 19, further comprising: 

2 means for using an arrow drawn on said at least one line as said property. 

1 25. The apparatus as in claim 19, further comprising: 

2 means for using a length of said at least one line as said property. 

1 26. The apparatus as in claim 19, further comprising: 

2 means for using a density of said at least one line as said property. 

1 27. The apparatus as in claim 19, further comprising: 

2 means for using a visual characteristic of said at least one line as said property. 

1 28. The apparatus as in claim 19, further comprising: 

2 means for displaying a filtering expression in a graphical user interface; 
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3 means for selecting, from said graphical user interface, records from network J 

4 information files to display said characteristic of said traffic. | 

1 29. The apparatus as in claim 28, further comprising: 

2 means for calculating parameters that are associated with the records selected from 

3 network files and storing the parameters in a local file. 

1 30. The apparatus as in claim 19, further comprising: 

2 means for displaying the characteristic as any graphical black and white or color 

3 image capable of being displayed on a data visualization system coupled to said computer. 

1 31. The apparatus as in claim 19, further comprising: 

2 means for using a filtering program to select records in network information files that 

3 meet selected filtering criteria. 

1 32. The apparatus as in claim 31, further comprising: 

2 means for compiling the appropriate records from network information files during 

3 specified time intervals, each compiled record meeting at least one selected filtering criterion. 
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1 33. The apparatus as in claim 32, further comprising: | 

2 means for calculating data that represent the compiled records, and storing the data in fl 

3 a file. ' 

1 34. The apparatus as in claim 19, further comprising: 

2 means for displaying a map of the network topology and overlaying the map with 

3 moving images that graphically portray the stored data, the moving images changing with 

4 time to reflect changes in the underlying data. 

1 35. The apparatus as in claim 19, further comprising: 

2 means for including a time interval criterion which indicates how often to compile 

3 and package information from the network information files. 

1 36. The apparatus as in claim 19, further comprising: 

2 means for displaying a network activity for a period of time within a starting time and 

3 an ending time specified within a filtering criteria. 
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1 37. A data visualization apparatus for graphically presenting characteristics of data traffic on 

2 a distributed computer network, comprising: ^ 

3 a computer to monitor traffic on said network; 

4 a graphical user interface to select a characteristic of said traffic for display; 

5 a visualization system to present said characteristics in a graphical format, said 

6 graphical format representing said network in response to said monitoring, said network 

7 represented as nodes connected by lines, said lines representing traffic flow between nodes; 

8 and 

9 instructions in said computer to display a property of at least one line of said lines, 
10 said property indicating a value of said characteristics. 



1 38. The apparatus as in claim 37, further comprising: 

2 instructions to execute in said computer to obtain said value from said monitoring 

3 during a selected time interval. 

1 39. The apparatus as in claim 37, further comprising: 

2 instructions to execute in said computer to display a sequence of said images, to 

3 display changes in said characteristics during a sequence of time intervals. 

1 40. The apparatus as in claim 37, further comprising: 



18 



2 
3 



instructions to execute in said computer to use a width of said at least one line as said 
property. 



1 41. The apparatus as in claim 37, further comprising: 

2 instructions to execute in said computer to use a color of said at least one line as said 

3 property. 

1 42. The apparatus as in claim 37, further comprising: 

2 instructions to execute in said computer to use an arrow drawn on said at least one 

3 line as said property. 

1 43. The apparatus as in claim 37, further comprising: 

2 instructions to execute in said computer to use a length of said at least one line as said 

3 property. 

1 44. The apparatus as in claim 37, further comprising: 

2 instructions to execute in said computer to use a density of said at least one line as 

3 said property. 
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45. The apparatus as in claim 37, further comprising: 

instructions to execute in said computer to use a visual characteristic of said at least 
one line as said property. 



1 46. The apparatus as in claim 37, further comprising: 

2 instructions to execute in said computer to display a filtering expression in a graphical 

3 user interface; 

4 instructions to execute in said computer to select, from said graphical user interface, 

5 records from network information files to display said characteristic of said traffic. 

1 47. The apparatus as in claim 46, further comprising: 

2 instructions to execute in said computer to calculate parameters that are associated 

3 with the records selected from network files and storing the parameters in a local file. 

1 48. The apparatus as in claim 37, further comprising: 

2 instructions to execute in said computer to display the characteristic as any graphical 

3 black and white or color image capable of being displayed on a data visualization system 

4 coupled to said computer. 
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1 49. The apparatus as in claim 37, further comprising: 

2 instructions to execute in said computer to use a filtering program to select records in 

3 network information files that meet selected filtering criteria. 

1 50. The apparatus as in claim 49, further comprising: 

2 instructions to execute in said computer to compile the appropriate records from 

3 network information files during specified time intervals, each compiled record meeting at 

4 least one selected filtering criterion. 

1 51. The apparatus as in claim 50, further comprising: 

2 instructions to execute in said computer to calculate data that represent the compiled 

3 records, and storing the data in a file. 

1 52. The apparatus as in claim 37, further comprising: 

2 instructions to execute in said computer to display a map of the network topology and 

3 overlaying the map with moving images that graphically portray the stored data, the moving 

4 images changing with time to reflect changes in the underlying data. 
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1 53. The apparatus as in claim 37, further comprising: 

2 instructions to execute in said computer to include a time interval criterion which 

3 indicates how often to compile and package information from the network information files. 

1 54. The apparatus as in claim 37, further comprising: 

2 instructions to execute in said computer to display a network activity for a period of 

3 time within a starting time and an ending time specified within a filtering criteria. 

1 55. A computer readable media, comprising: 

2 • said computer readable media having instructions written thereon for execution on a 

3 computer for the practice of the method of claim 1 . 

1 56. Electromagnetic signals propagating on a computer network, comprising: 

2 said electromagnetic signals carrying instructions for execution bn a computer for the 

3 practice of the method of claim 1 . 
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